Flaws in Apple WebKit Can Expose Real IP Addresses Despite Private Relay, Researchers Warn

August 6, 2026

A series of technical flaws in Apple’s WebKit browser engine can allow websites to circumvent iCloud+ Private Relay and discover a user’s actual IP address, according to security researchers.

What Happened

Security researchers Talal Haj Bakry and Tommy Mysk revealed that Apple’s Private Relay feature can be bypassed to expose a user’s real IP address. The issue, which was first reported by 404 Media and detailed on the researchers’ blog, stems from three specific features within WebKit, the web browser engine developed by Apple and utilized by all web browsers on iOS.

To demonstrate the flaw, the researchers launched a public test website allowing individuals to check whether their real IP address leaks when Private Relay is enabled. Independent testing by TechCrunch confirmed that the site successfully revealed a tester’s actual IP address despite having the privacy feature active.

Mysk stated on X that the researchers decided not to submit the vulnerability directly to Apple, citing previous interactions that involved prolonged delays, inconsistent responses, and occasional denials regarding the severity of reported problems. Apple did not immediately provide a statement when asked for comment.

Key Highlights

Vulnerabilities tied to three features in Apple’s WebKit engine can circumvent Private Relay protections.
The issue was identified by researchers Talal Haj Bakry and Tommy Mysk, and first covered by 404 Media.
A demonstration webpage created by the researchers was verified by TechCrunch to expose real IP addresses.
Private Relay is an opt-in privacy feature exclusive to iCloud+ subscribers and functions solely within the Safari browser rather than acting as a full system-wide VPN.
The researchers stated that mitigations have been deployed in their own private browser, Psylo, to stop the address leakage.

Why This Matters

Apple’s Private Relay is an opt-in feature marketed to iCloud+ subscribers to conceal their IP addresses while navigating the web using Safari. Because Private Relay operates specifically within Safari rather than securing all system network traffic like a traditional Virtual Private Network (VPN), flaws residing within WebKit directly undermine the intended privacy protections for users relying on the service.

What to Watch Next

Observers are awaiting a response from Apple regarding the disclosed WebKit flaws. Additionally, users can observe whether future updates to WebKit and Safari address the specific mechanism causing the IP leaks.

Frequently Asked Questions

What is Apple Private Relay?

Private Relay is an opt-in feature for iCloud+ subscribers designed to hide a user’s IP address when browsing the internet through Apple’s Safari browser.

Is Private Relay the same as a VPN?

No. Unlike a Virtual Private Network (VPN), which protects an IP address at the entire operating system level, Private Relay functions exclusively within Safari.

What is causing the IP address leak?

According to researchers Talal Haj Bakry and Tommy Mysk, the leak is caused by vulnerabilities across three features in Apple’s WebKit engine, which powers browsers on iOS.

Source: Based on reporting from TechCrunch, 404 Media, and research published by Talal Haj Bakry and Tommy Mysk.